Thanks! Actually I was hoping for a little more detail 
The address is something like sha256(curve25519(sha256(key))). It is presumably as easy or hard to bruteforce this regardless of whether an account has been verified. If you know the key, you have access to the account.
You must be talking about an intermediate step - a way of sending funds from an account without using its private key?
I don't think this got replied to. As I understand it, that's not what an account is in Nxt. In Nxt an account is only the first 64 bits of the hash. That's why it's relatively weak. It's also why it can be expressed in 21 digits, where Bitcoin needs 34 alphnumeric characters. So account collisions are much more likely in Nxt. When you first send from a Nxt account, your public key is registered to the account, and that brings the security back up to 256 bits. The address is something like sha256(curve25519(sha256(key))). It is presumably as easy or hard to bruteforce this regardless of whether an account has been verified. If you know the key, you have access to the account.
You must be talking about an intermediate step - a way of sending funds from an account without using its private key?
